Prevent (Restrict) passing parameter in URL of window.Open in AngularJS

I have an AngularJS application in which  am trying to open a purchase order pdf file in new window by passing id of selected order.For eg.

$window.open("https://test.com/app/site/script.nl?&requestType=view&po="+1234);

If user changes &po value to '12345', a complete different order might be displayed which might not be in current user list

I want to prevent user from manipulating value of &po in the browser which may open a order not belonging to user. 

Any help with demo will be greatly appreciated.